In packet switching networks a “traffic flow” (also referred to as a “packet flow”) is a sequence of packets between a source device and a destination device which share common characteristics and/or identifiers. For example, a traffic flow may consist of all packets sent during a particular connection, session, media stream, etc. As another example, RFC 2722 “Traffic Flow Measurement: Architecture” authored by Brownlee, et al. describes traffic flows as artificial logical equivalents to a call or connection and elaborates on techniques for identifying and measuring traffic flows.
Collecting metrics related to traffic flows is critical to both service providers and customers to manage the network and monitor application performance. For example, service providers may require metrics regarding the amount of data sent over a particular flow in order to charge the customer for utilizing the service provider's network. As another example, customers may require metrics regarding an application's performance in order to quickly detect potential problems before they have a significant business impact. However, although metrics are important to users of the network, the overhead involved in monitoring the traffic flows can place a significant burden on the network devices (e.g. routers, switches, etc.) forwarding the traffic.
In one approach, the network devices are configured to perform packet sampling. During packet sampling, the network devices monitor only a subset of the packets sent over a given flow. For example, the network devices may randomly select packets for inspection (e.g. based on a packet sampling rate) and perform interpolation to determine the estimated metrics for the entire traffic flow. As a result, packet sampling reduces the workload placed on the network devices since fewer packets are inspected. However, since the network devices collect an incomplete set of data from the flow, the estimated metrics possess a non-zero rate of error. Furthermore, skipping packets impacts on the ability to collect certain types of metrics, such metrics related to network delay and the performance of different phases of an application or protocol.